Windows Server / Active Directory & Group Policy
Check whether a server can use its intended gMSA
A service using a group managed service account can fail when the host is not authorized or the account is not installed correctly.
Environment and inputs: Windows Server 2022 / 2025 baseline · Windows PowerShell with the specified role or RSAT modules; native utilities are identified in the text. Use delegated administration and elevation only where required.
Start with this check
Confirm the host, shell and access role. Replace sample names, paths, domains and interfaces with approved targets. These are diagnostic commands; assess policy and workload impact before making changes.
Test-ADServiceAccount -Identity app_gmsaRead the result
On the intended member server with the ActiveDirectory module, the test checks readiness for the specified account in that host context.
Resolve and verify
Compare host authorization, account installation and directory connectivity with the approved gMSA deployment. Correct the specific dependency and retest service startup.
Before changing production
Do not convert to a shared static password as a shortcut or broaden host authorization beyond the intended service group.